The present invention relates generally to systems, methods and apparatus for providing forensic markings for media content. Forensic marking is the practice of creating individual copies of information content that are substantially identical for most practical purposes, but that can in fact be distinguished from one another in order to ascertain information about their chain-of-custody subsequent to their distribution. For example, intentionally introduced errors in logarithmic tables were used in previous centuries to prove that certain publications of those tables had been copied from a particular source without authorization from the table's creator. In the modern era, forensic marking is widely viewed as an important technique for protection of valuable media information content such as movies, music, programming, documents, and other digital information content such as software and data files and has convincingly demonstrated its commercial efficacy. Forensic marking is typically intended to assist in locating a point in the chain-of-custody where an unauthorized use of the content occurred.
A wide range of schemes have been proposed for introducing identifiable marks into content and for subsequently identifying their presence. The broad class of techniques commonly known as “watermarking”, wherein auxiliary data is imperceptibly embedded into the content, are most commonly associated with this task, however a range of different approaches are possible. An exemplary methodology that does not incorporate watermarking is to simultaneously capture one or more scenes in a film production by employing two cameras at different locations and using these similar recordings as alternately selectable versions of content for the purpose of distinguishing copies. Another approach that can be employed with video content is to superimpose a figure or graphic onto the image that is either brief and unnoticeable (such as the “cap coding” dots that are reported to be employed in commercial film production) or that is innocuous (such as superimposing an additional face in a crowd or changing the color of a chair).
Various forensic marking schemes offering differing performance and capabilities with respect to: the types of content to which they are applicable (e.g., video, audio, textual, images, executable program instructions, data, etc.); the degree of transparency or interference of the marking with respect to primary intended purpose of the content; the payload capacity of the marking (e.g., number of uniquely marked copies that can be generated and the amount of the marked content necessary to identify the mark); the effort required to apply or identify the mark (e.g., the computational complexity of insertion or detection of the forensic mark); the recoverability of the mark following incidental use and modification of the content (“robustness”); or the resistance of the mark to attempts to interfere with its use (“security”) through forgery, modification, eavesdropping, and erasure.
In many practical circumstances, the marking must be performed under tight constraints. For example, when a high volume of individually marked copies of content must be created, it is desirable that each should be made as effortlessly as possible to minimize time, expense or resource usage. Additionally, when a copy of content must be marked at the time of its delivery or use, it is typically important that the marking occur with minimal effort so as not to delay the delivery or interfere with other simultaneous actions associated with the event. For example, on a computer server system that provides copies of content in response to requests received over a network, the effort required to supply a distinctly marked copy in response to individual requests may substantially increase the amount of processing and/or storage required to respond to a given number of requests, versus simply providing the same copy of the content in response to each, as is more typically done. Similarly, if the marking must be applied using digital electronics embedded within a consumer device such as a personal computer, portable music player, or multimedia-enabled cellular telephone, it is important that the process of customizing individual copies does not interfere with or limit other device functions, including in the areas of computing processor utilization, power consumption, or user-interface response time.
A valuable approach to minimizing the effort in forensic marking is to divide the forensic marking activity into two steps. The first step performs a “pre-processing” of the content that only needs to be performed once and may require substantial effort in order to produce one or more versions of the content and possibly also to analyze data that can be used in a subsequent “customization” step of reduced effort that is repeated with minor variations to produce the forensically marked copies of the content. While the customization step of a two-step forensic marking scheme is not inherently limited to any particular operation, some examples of common functions that may be typically included in such an arrangement include splicing of regions of content together, replacement of certain regions of content with regions taken from other content, mathematical addition of regions of content, mathematical additional of a region taken from content with the mathematical multiplication of two other content regions, and the like. This approach is generally employed in an arrangement where the pre-processing and customization steps are performed on separate physical devices and at different stages of the chain of production, distribution, and consumption of content.
Another critical consideration in forensic marking is the vulnerability of marking techniques to subversion through various avenues of attack by individuals seeking to thwart identification of the forensic mark. Such attacks may by implemented by a variety of means, but typically involve transforming the content such that the mark is altered or obscured.
It is generally advantageous to an attacker making an attack on a marking technique if they have knowledge of the details of the marking technique employed, and for this reason it is desirable for the efficacy of the system that as much information about the marking techniques employed for any particular content instance be unavailable to them. Generally, in order to avoid exposure of marking methods, tamper-resistant implementation techniques are employed in order to protect devices that perform marking and information stored internally from reverse engineering. However, a particular advantage of the two-step forensic marking approach for environments where marking is performed in a device that may be attacked is that it is possible for many of the sensitive technologies to be employed during the pre-processing step, which can be retained under the control of the content distributor, and the information regarding the marking scheme that needs to be present in the device that performs customization can be much more limited. Furthermore, cryptographic techniques may be used to enhance the security of the forensic marking system. For example, the information that is delivered to a particular customization device, including all alternate versions of the original content signal plus functions and parameters that are necessary to effect the marking, may be encrypted and the particular customization device may be required to request the delivery of proper decryption keys upon the exchange of proper identification and authentication information. Further, through encryption of alternate versions of the content with different keys and by providing the customization function with only the decryption keys associated with the versions of content that are used to form mark messages that the device is authorized to render, the security impact of a compromised customization device may be substantially diminished. In such a scenario, the attacker may be unable to access any content elements other than those that are specifically accessible to the compromised device.
Nevertheless, a number of factors may still frustrate efforts to keep secret information out of an attacker's hands. Attackers may be able to learn about particular marking technologies from any of many different sources, including leaks of confidential information, from information included in patent filings, from reverse engineering of devices that perform marking or mark detection functions, or from analysis of marked content (including, in particular, comparative analysis or combined processing of differently marked versions of the same content, the so called “collusion” attacks).
If only a single marking technique is employed, then the emergence of a successful attack may be immediate and catastrophic. Thus, it may be advantageous to employ a multiplicity of marking techniques across a range of content and devices at any given point in time. Further, if the marking technique employed is fixed, its resistance to attack will only diminish over time as information on its function is slowly gleaned by attackers. Thus it may be advantageous to be able to change marking techniques employed on a time schedule that is responsive to progress made by attackers over time.
There are additional practical considerations related to the use of forensic marking schemes. It may be desirable for the manufacturer of some product that processes content to facilitate the forensic marking of the content using a variety of different schemes. For example, the various owners or distributors of different content processed by the device might want different schemes to be used in connection with particular content which they provide for use on the device, and those wishes might change over time due to purely commercial considerations. Additionally, different types of content (such as 3 minute popular music songs versus 8 hour audiobooks) might introduce entirely different marking requirements because of their duration, bandwidth, attack threat model, commercial value, sales volume, or some other consideration. For the manufacturer of such a device, it may be impractical, burdensome, or even impossible to include sufficient capability to support all desired forensic marking schemes and a capability to update the devices functions over time, even if the marking schemes permit separate pre-processing and customization such that the device need only perform the customization steps of the various forensic marking schemes.
Clearly, if the customization step is carried out on a general-purpose programmable device, such a device may be reprogrammed at various times to apply different forensic marking techniques. Such reprogramming might be performed or even provided in conjunction with each particular piece of content, if programming instructions are provided along with the content. However, if the marking must be performed on a variety of different types of programmable devices, it may be impractical or burdensome to provide instructions for each different programmable device.
It has been proposed that a desirable method of flexibly applying forensic marking is through inclusion of a common programmable capability or so-called “virtual machine” that can execute arbitrary data processing functions expressed in program code delivered with content, including those that customize pre-processed, encrypted content in order to achieve forensic marking. This approach places a substantial burden of complexity on the device that performs customization, which must implement the virtual machine and be capable of executing the arbitrary program instructions. Additionally, it places a burden on the content producer and forensic scheme technology developer for devising program instructions and ensuring their correctness, tasks that are generally difficult, expensive, and error-prone.
Another proposed approach to the flexible application of forensic marking in a diverse range of devices is the creation of a standardized, common function that can perform a complete forensic marking operation on content in response to marking instructions provided with the content. This approach employs a set of common, fixed data processing primitives with adjustable parameters that are believed to support a range of commercially useful forensic watermark embedding schemes. This approach provides reduced complexity with respect to the development and testing of marking instruction streams in comparison with an approach that employs a generic “virtual machine,” but has several other significant drawbacks. First, the range of marking techniques that such a device can support will be inherently limited by the scope of the available primitives. As pointed out herein, a very wide range of methods have been proposed for watermarking, not to mention forensic marking generally, and diversity in the area of marking techniques is of benefit to mark security and commercial acceptability. The limitation of the fundamental method of forensic marking to a finite set that can be incorporated in a standardized specification substantially limits the efficacy and practicality of the system.
Also, the amount of processing required for many practical forensic watermarking techniques is substantial, and inclusion of the complete forensic mark application within the device responsible for content customization may have a significant negative impact on the cost and/or performance of such devices. For example, the embedding function in many practical watermarking schemes rely on perceptual modeling of the content being marked to constrain the amplitude of modifications to an amount that results in an acceptable level of perceptual distortion. Such modeling may be difficult to express in a generic messaging language, may require substantial processing and memory resources, and may introduce significant processing latency. This impact may make such an approach unsuitable for large classes of devices, such as portable media players, cellular phones, optical media players, handheld recording devices, and the like.
It would be advantageous to provide flexible forensic watermarking methods, systems and apparatus which are designed to overcome various deficiencies of the prior art systems. More specifically, it would be advantageous to be able to flexibly employ a range of different marking techniques in different instances that all rely on a common customization function that is applicable to a wide range of forensic marking schemes (and consequently, a wide range of pre-processing methods), but that support a well-defined set of functions specific to the task of forensic mark customization that can be carried out with a modest and preferably bounded effort on a wide range of devices. Because a very wide range of techniques are used for marking content, there has previously been no practical way to address these challenges. The present invention achieves such desirable features through the use of a generic transformation technique for use as a “customization” step for producing versions of content forensically marked with any of a multiplicity of mark messages, wherein the customization function is responsive to instructions provided along with pre-processed content that enable its compatibility with a range of different forensic marking schemes.
The methods, systems and apparatus of the present invention provide the foregoing and other advantages.